Skip to content
Threat Feed

Vendor

SOGo

1 brief RSS
high threat

CVE-2026-8851: SOGo SQL Injection Vulnerability in ACL Management

SOGo 5.12.7 is vulnerable to SQL injection in the Access Control List management functionality, allowing authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the addUserInAcls endpoint, which can be exfiltrated via the /acls API.

SOGo 5.12.7 sql-injection cve-2026-8851 data-exfiltration
2r 3t 1c